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March  2, 1999 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  INFORMATION  SYSTEMS 

AGENCY 

DIRECTOR,  DEFENSE  LOGISTICS  AGENCY 

SUBJECT:  Audit  Report  on  Year  2000  Computing  Issues:  Defense  Logistics  Agency 
Distribution  Standard  System  (Report  No.  99-100) 


We  are  providing  this  report  for  review  and  comment.  This  report  is  one  of  a 
series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in  accordance  with  an 
informal  partnership  with  the  Chief  Information  Officer,  DoD,  to  identify  progress  made 
by  DoD  Components  who  are  preparing  information  and  technology  systems  for  year 
2000  compliance.  We  considered  management  comments  on  a  draft  of  this  report  in 
preparing  the  final  report. 

DoD  Directive  7650.3  requires  that  all  recommendations  and  issues  be  resolved 
promptly.  Therefore,  we  request  that  the  Director,  Defense  Logistics  Agency,  provide 
additional  comments  on  Recommendations  1  .a.,  1  .b.,  1  .c.,  1  .d.,  and  2.a.,  by  March  31, 
1999. 


We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Ms.  Kathryn  Palmer  at  (703)  604-8840  (DSN  664-8840),  email 
<kpalmer@dodig.osd.mil>,  or  Mr.  Tilghman  Schraden  at  (703)  604-9186 
(DSN  664-918 6),  email  <tschraden@dodig.osd.mil>.  See  Appendix  D  for  the  report 
distribution.  The  audit  team  members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 
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Year  2000  Computing  Issues:  Defense  Logistics  Agency 
Distribution  Standard  System 


Executive  Summary 


Introduction.  This  is  one  of  a  series  of  reports  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge.  For  a 
complete  listing  of  audit  projects,  see  the  year  2000  webpage  on  the  IGnet  at 
http://www.ignet.gov. 

Objectives.  The  overall  audit  objective  was  to  evaluate  whether  the  Defense  Logistics 
Agency  (DLA)  was  adequately  planning  for  and  managing  year  2000  risks  to  avoid 
undue  disruption  to  its  supply  mission.  This  audit,  the  first  in  a  series  on  the  DLA  supply 
mission,  focused  on  the  core  DLA  supply  system,  the  Distribution  Standard  System. 

Results.  DLA  recognized  the  importance  of  the  year  2000  issue  as  it  pertains  to  the 
Distribution  Standard  System  and  other  automated  systems,  and  had  taken  many  positive 
actions  in  addressing  the  year  2000  problem.  Those  actions  included  the  prioritization  of 
mission-critical  systems;  the  development  of  a  DLA  Year  2000  Management  Plan;  the 
development  of  a  DLA  Year  2000  Test  and  Evaluation  Master  Plan;  and  the  development 
of  contingency  plans.  However,  the  progress  that  DLA  made  in  resolving  the  year  2000 
computing  issue  was  not  complete.  DLA  did  not  have  a  depot-level  checklist  to  assist 
consistent  implementation  of  the  DLA  Year  2000  Management  Plan  at  the  depot  level. 
DLA  had  not  identified  all  Distribution  Standard  System  interfaces,  and  the  interface 
agreements  lacked  critical  data.  DLA  had  not  developed  all  required  test  plans  or  testing 
milestone  schedules.  In  addition,  the  Distribution  Standard  System  megacenter  test 
domain  was  not  year  2000  compliant  and  explicit  test  agreements  between  the  Defense 
Megacenters  and  DLA  required  by  Secretary  of  Defense  policy  had  not  been  signed. 
Actions  to  correct  those  deficiencies  will  help  ensure  that  functions  supported  by  the 
Distribution  Standard  System  will  not  be  impaired  in  the  year  2000  and  beyond.  See  the 
Finding  section  of  the  report  for  details  of  the  audit  results. 

Summary  of  Recommendations.  We  recommend  that  the  Director,  DLA,  develop  a 
checklist  to  ensure  that  the  DLA  Year  2000  Management  Plan  is  implemented 
consistently  at  the  distribution  depot  level;  identify  all  mission-critical  Distribution 
Standard  System  interfaces  and  include  all  required  data  in  interface  agreements;  and 
develop  a  detailed  plan  and  schedule  for  all  remaining  tests.  We  recommend  that  the 
Director,  Defense  Information  Systems  Agency,  in  conjunction  with  the  Director,  DLA, 
take  action  to  ensure  that  the  hardware  and  executive  software  portion  of  the  Distribution 
Standard  System  domain  is  year  2000  compliant  prior  to  completion  of  the  Distribution 
Standard  System  testing  and  certification  and  sign  explicit  test  agreements  for  the 
Distribution  Standard  System  as  required  by  Secretary  of  Defense  policy. 


Management  Comments.  The  Director,  DLA,  concurred  or  partially  concurred  with 
recommendations  to  develop  a  depot-level  checklist;  to  complete  the  inventory  of  the 
Distribution  Standard  System  interfaces;  to  develop  a  comprehensive  test  plan  and 
schedule;  to  validate  that  year  2000  domain  status  reports  are  accurate;  to  obtain  a  waiver 
for  a  noncompliant  compiler;  and  to  initiate  and  sign  explicit  test  agreements  with  the 
Defense  Megacenters.  DLA  stated  that  a  depot-level  checklist  existed  and  the  inventory 
of  Distribution  Standard  System  interfaces  had  been  completed.  DLA  also  stated  that  die 
DLA  test  and  certification  process  requires  test  plans  for  the  operational  assessment  and 
time  machine  testing  and  that  a  waiver  had  been  granted  allowing  the  use  of  the  COBOL 
compiler.  Additionally,  DLA  stated  that  explicit  test  agreements  had  been  signed  with 
the  Defense  Information  Systems  Agency.  DLA  nonconcurred  with  the  recommendation 
to  include  the  complete  inventory  of  interfaces  in  the  follow-on  interface  testing,  stating 
that  the  Distribution  Standard  System  is  a  compliant  production  system  and  that  all 
interfaces  were  simulated  during  the  validation  testing.  DLA  also  nonconcurred  with  the 
recommendation  to  ensure  that  the  Distribution  Standard  System  test  domain  was  Y2K 
compliant  prior  to  certification.  DLA  stated  that  it  had  a  waiver  that  allows  the 
Distribution  Standard  System  to  be  certified  as  compliant  based  on  the  existing  testing. 
The  Defense  Information  Systems  Agency  concurred  with  the  finding  and  all 
recommendations,  stating  that  the  Distribution  Standard  System  test  domain  would  be 
compliant  no  later  than  January  31, 1999,  and  that  quality  control  checks  had  been 
performed  on  the  database  to  ensure  its  accuracy.  In  addition,  the  Defense  Information 
Systems  Agency  indicated  that  it  would  assist  DLA  in  obtaining  a  waiver  for  the 
compiler  and  that  explicit  test  agreements  were  in  place  for  major  customers.  See  the 
Finding  section  of  the  report  for  a  discussion  of  management  comments  and  the 
Management  Comments  section  of  the  report  for  the  complete  text  of  the  comments. 

Management  Actions.  The  Distribution  Standard  System  was  certified  year  2000 
compliant  by  DLA  on  December  30, 1998.  On  January  5, 1999,  the  Office  of  the 
Secretary  of  Defense  issued  two  waivers  that  allowed  certification  even  though  the 
Distribution  Standard  System  test  domain  was  not  compliant.  As  of  January  31, 1999, 
the  Defense  Information  Systems  Agency  production  and  test  domains  for  die 
Distribution  Standard  System  were  not  fully  compliant.  DLA  completed  its  contingency 
plan  for  the  Distribution  Standard  System  on  November  24,  1998,  and  is  refining  the  plan 
in  preparation  for  end-to-end  testing  scheduled  for  March  through  June  1999. 

Audit  Response.  DLA  comments  were  not  fully  responsive.  DLA  still  needs  to  develop 
a  checklist  for  implementing  year  2000  compliant  hardware  and  software  at  the  depot 
level.  DLA  needs  to  reconcile  the  disparity  between  the  interface  agreements  provided  to 
us  and  the  final  list  of  interfaces.  DLA  also  needs  to  provide  an  explanation  of  work¬ 
arounds  for  noncompliant  software.  We  also  request  a  copy  of  the  migration  plan 
required  by  the  waivers  granted  by  the  Office  of  the  Secretary  of  Defense.  The  Defense 
Information  Systems  Agency  comments  were  partially  responsive.  However,  further 
comments  from  the  Defense  Information  Systems  Agency  are  not  required  because  of 
other  ongoing  reviews  by  this  office.  We  request  that  DLA  provide  additional  comments 
to  the  final  report  by  March  31, 1999. 
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Background 


Policies  on  Year  2000  Issues.  Because  of  the  potential  failure  of  computers  to 
run  or  function  throughout  the  Government,  the  President  issued  Executive  Order 
13073,  “Year  2000  Conversion,”  February  4, 1998,  making  it  policy  that  Federal 
agencies  ensure  that  no  critical  Federal  program  experiences  disruption  because  of 
the  year  2000  (Y2K)  problem.  The  order  requires  that  the  head  of  each  agency 
ensure  that  efforts  to  address  the  Y2K  problem  receive  the  highest  priority 
attention  in  the  agency. 

A  Secretary  of  Defense  memorandum,  “Year  2000  (Y2K)  Compliance,” 

August  7, 1998,  stated  that  DoD  was  making  insufficient  progress  in  its  effort  to 
solve  its  Y2K  computer  problem.  The  memorandum  directed  more  accountability 
and  reporting  requirements  at  the  highest  levels  within  DoD.  The  memorandum 
also  stated  that  if  Y2K  progress  is  still  lagging  in  November  and  December  1998, 
all  further  modifications  to  software,  except  those  needed  for  Y2K  remediation, 
would  be  prohibited  after  January  1, 1999. 

A  Deputy  Secretary  of  Defense  memorandum,  “Year  2000  (Y2K)  Verification  of 
National  Security  Capabilities,”  August  24,  1998,  stated  that  each  of  the  directors 
of  the  Defense  agencies  must  verify  that  all  functions  under  his  or  her  purview 
will  continue  unaffected  by  Y2K  issues.  The  memorandum  further  required  that 
the  designated  Principal  Staff  Assistant  provide  plans  for  Y2K-related  end-to-end 
testing  of  each  process  within  five  functional  areas,  including  logistics,  to  the 
Deputy  Secretary  of  Defense  by  November  1, 1998.  The  principal  staff  assistant 
for  logistics  is  the  Under  Secretary  of  Defense  for  Acquisition  and  Technology. 

Distribution  Standard  System.  The  Distribution  Standard  System  (DSS)  is  the 
core  automated  information  system  (AIS)  that  supports  the  Defense  Logistics 
Agency  (DLA)  distribution  depots’  mission  of  receiving,  storing,  retrieving, 
packing,  and  shipping  mater iels  from  its  22  depots  to  worldwide  DoD  customers. 
DSS  is  ranked  as  the  fifth  most  mission-critical  DLA  automated  system  needing 
Y2K  remediation.  DSS  consists  of  2,169  subprograms  containing  13.5  million 
lines  of  code  that  must  be  Y2K  compliant.  The  DLA  management  strategy  for 
fixing  Y2K  problems  calls  for  centralized  management  and  decentralized 
implementation.  The  key  position  and  organizations  responsible  for  ensuring  that 
DSS  is  Y2K  compliant  are  as  follows. 

•  The  DLA  Chief  Information  Officer  (CIO)  serves  as  the  chief  focal 
point  for  the  planning,  management,  and  execution  of  the  DLA  Year 
2000  Program.  The  DLA  Y2K  Program  Office  provides  the  direct 
oversight  of  DLA  Y2K  efforts  and  reports  to  the  DLA  CIO. 

•  The  Defense  Distribution  Center  (DDC)  is  the  command  headquarters 
for  the  22  DLA  distribution  depots  that  receive,  store,  retrieve,  pack, 
and  ship  materiels  to  worldwide  DoD  customers.  DDC  is  responsible 
for  coordination  and  oversight  of  Y2K  implementation  at  the 

22  distribution  depots. 
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•  The  Defense  Distribution  Systems  Center  is  the  DSS  program  office 
(DSS  Program  Office).  The  purpose  of  the  DSS  Program  Office  is  to 
develop,  test,  implement,  and  maintain  a  standard  distribution  system 
for  the  distribution  depots. 

•  The  DLA  Systems  Design  Center  (DSDC)  is  the  DLA  central  design 
activity  responsible  for  addressing  and  resolving  hardware  and  , 
software  related  problems  associated  with  Y2K  compliance  for  DLA 
automated  systems.  DSDC  has  been  tasked  to  lead  the  development  of 
necessary  automation  support  (for  example,  bridges,  filters,  and  new 
programs)  to  make  DSS  hardware  and  software  Y2K  compliant. 

•  The  Defense  Information  Systems  Agency  (DISA)  is  the  central 
manager  for  major  portions  of  the  Defense  Information  Infrastructure. 
DISA  is  responsible  for  planning,  developing,  and  supporting 
Command,  Control,  Communications,  Computers,  and  Intelligence 
operations  functions.  In  that  capacity,  DISA  provides  support  to  the 
DoD  CIO  in  executing  Y2K  initiatives,  which  includes  maintenance  of 
a  list  of  tools  to  assist  in  resolving  Y2K  problems  and  a  list  of  all 
commercial  off-the-shelf  products  and  their  status  as  to  Y2K 
compliance.  DISA  is  also  responsible  for  operating  16  computer 
processing  activities  referred  to  as  megacenters. 

•  The  Defense  Megacenters  (DMCs)  operate  on  a  fee-for-service  basis  in 
providing  mainframe  computer  processing  service  to  functional  users. 
DMCs  are  the  primary  providers  of  mainframe  computer  services  to 
functional  users  in  the  Army,  the  Navy,  the  Air  Force,  the  Marine 
Corps,  and  the  Defense  agencies  (such  as  DLA).  DMCs  are 
responsible  for  the  Y2K  compliance  of  the  computer  hardware  and  the 
executive  software. 


Objectives 

The  overall  audit  objective  was  to  evaluate  whether  DLA  was  adequately 
planning  for  and  managing  Y2K  risks  to  avoid  undue  disruption  to  its  supply 
mission.  Specifically,  we  reviewed  Y2K  risk  assessments,  testing,  and 
contingency  plans  for  systems  that  support  the  mission  and  continuity  of 
operations  to  perform  the  core  supply  mission.  This  audit,  the  first  in  a  series  on 
the  DLA  supply  mission,  focused  on  the  core  DLA  supply  system,  DSS.  We  did 
not  review  the  management  control  program  related  to  the  overall  audit  objective 
because  DoD  recognizes  the  Y2K  issue  as  a  material  management  control 
weakness  area  in  the  FY  1998  Annual  Statement  of  Assurance.  See  Appendix  A 
for  a  discussion  of  the  audit  scope  and  methodology  and  for  a  summary  of  prior 
coverage. 
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Status  of  the  Distribution  Standard 
System  Year  2000  Program 

DLA  has  taken  many  positive  actions  to  identify  and  correct  Y2K 
problems  for  DSS  and  other  automated  systems.  In  response  to  an  August 
1997  General  Accounting  Office  (GAO)  report,1  DLA  prioritized  systems, 
inventoried  unique  applications  at  the  depot  level,  and  was  in  the  process 
of  completing  contingency  planning.  However,  additional  DLA  action  is 
needed  to  minimize  the  potential  adverse  impact  of  Y2K  date  processing 
on  DSS  by: 

•  developing  a  comprehensive  depot-level  standard  Y2K 
checklist; 

•  identifying  all  interfaces  and  properly  preparing  interface 
agreements; 

•  developing  a  plan  and  schedule  for  operational  assessment  and 
time  machine  testing;  and 

•  executing  required  testing  agreements  with  DMCs  and  ensuring 
test  domain  is  Y2K  compliant. 


Actions  Taken  to  Address  the  Year  2000  Problems 


The  August  1997  GAO  report  credited  DLA  with  recognizing  the  potential  impact 
of  the  Y2K  problem  and  having  taken  action  to  identify  systems,  to  assess  the 
Y2K  impact  on  its  operations,  and  to  develop  and  issue  policies,  guidelines, 
standards,  and  recommendations  on  Y2K  corrections  for  the  agency.  GAO  also 
noted  that  DLA  had  not  completed  several  critical  steps  that  included  the 
identification  of  interface  partners;  the  inventory  of  field-developed  unique 
programs;  the  prioritization  of  systems;  and  contingency  planning.  DLA  has 
made  significant  progress  in  correcting  many  Y2K  management  problems  that 
impact  the  management  of  DSS  as  well  as  other  DLA  logistics  systems.  DLA 
management  actions  included: 

•  prioritized  mission-critical  systems  (DSS  ranked  fifth  out  of  34); 

•  established  DLA  Y2K  points  of  contact; 

•  developed  DLA  Y2K  Management  Plan; 


‘GAO  Report  No.  AIMD-97-106,  “Defense  Computers:  Issues  Confronting  the  Defense  Logistics  Agency 
in  Addressing  Year  2000  Problems,”  August  12,  1997. 
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•  developed  draft  DLA  Test  and  Evaluation  Master  Plan;  and 

•  inventoried,  tracked,  and  reported  Y2K  compliance  status  on  a 
monthly  basis  for  depot-unique  software  and  hardware  platforms. 

In  addition,  DLA  made  significant  progress  in  developing  a  contingency  plan  for 
DSS. 


Risk  Management 

The  “DoD  Year  2000  Management  Plan,  Version  2”  (DoD  Management  Plan), 
December  1998,  states  that  even  Y2K  compliant  systems  may  experience  various 
degrees  of  disruptions  as  a  result  of  interface  or  user  defined  data  problems  or 
problems  with  infrastructure.  Further,  it  states  that  DoD  needs  to  identify  all 
potential  Y2K  risks  and  threats  to  the  continuity  of  its  operations  and  take  actions 
to  mitigate  those  risks.  DLA  has  taken  many  positive  steps  toward  identifying 
risks  and  taking  action  to  mitigate  those  risks  in  the  management  of  DSS. 
However,  additional  action  is  needed  in  order  to  ensure  that  DSS  performs  the 
operational  mission  in  the  Y2K  environment. 


Consistent  Y2K  Program  Implementation 

The  DLA  approach  to  fixing  Y2K  problems  mirrors  the  DoD  approach, 
centralized  management  with  decentralized  execution.  Overall,  DDC  was  actively 
working  with  subordinate  distribution  depots  as  well  as  the  DLA  Y2K  Program 
Office  and  the  DSS  Program  Office  to  ensure  that  the  depots  were  implementing 
the  DLA  Y2K  program.  However,  the  lack  of  a  standardized  depot-level  process 
for  all  depots  to  follow  in  ensuring  that  Y2K  problems  were  being  addressed  has 
the  potential  to  result  in  overlooking  Y2K  problems. 

Although  DDC  required  monthly  updates  from  each  depot  on  Y2K  status  of  all 
equipment  and  software,  there  was  no  standardized  checklist  or  process  that 
ensured  each  depot  considered  all  hardware  and  software.  For  instance,  as  a  result 
of  the  audit  team’s  questions  during  our  site  visit  to  the  Defense  Distribution 
Depot,  San  Diego,  the  depot  personnel  found  that  a  new  software  program 
(NS/ELITE  PLUS,  version  2.20)  furnished  by  DLA  was  not  listed  as  Y2K 
compliant  on  the  vendor’s  Internet  list  of  compliant  software  products.  That 
software  functioned  as  a  software  program  manager  much  like  the  program 
manager  function  found  in  the  Windows  software  suites.  The  automation  officials 
in  San  Diego  were  unaware  of  the  noncompliance  because  the  site  was  one  of  the 
last  DLA  depots  to  convert  to  DSS.  The  software  and  most  of  the  hardware 
platforms  were  new  and  might  not  have  been  reviewed  as  closely  as  older  systems 
with  known  noncompliance  issues.  If  the  new  software’s  noncompliance  had 
remained  undetected  and  uncorrected,  approximately  500  personal  computers 
could  have  experienced  Y2K  problems  and  the  users  could  have  had  problems 
accessing  DSS  or  other  compliant  application  software  to  perform  the  operational 
mission.  Defense  Distribution  Depot,  San  Diego,  officials  took  immediate  action 
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to  obtain  the  compliant  version  of  software  from  the  vendor.  In  subsequent 
discussions,  DLA  indicated  that  the  software  vendor  had  incorrectly  indicated  that 
the  NS/ELITE  PLUS,  version  2.20,  was  noncompliant.  The  vendor  was  to 
provide  a  statement  to  DLA  that  corrects  the  information  posted  on  the  Internet. 
As  of  November  20, 1998,  DLA  had  not  received  the  statement.  However,  the 
January  21, 1999,  DLA  response  to  the  draft  report  stated  the  depot  had 
downloaded  the  Y2K  compliant  2.22  version  from  the  contractor’s  web  site  and 
had  upgraded  the  personal  computers  at  no  cost  to  the  government. 


Interfaces  and  Interface  Agreements 


The  DSS  Program  Office  had  not  completed  inventorying  mission-critical 
interfaces.  DLA  identified  varying  numbers  of  external  and  internal  interface 
partners.  Additionally,  existing  interface  agreements  did  not  contain  all  of  the 
required  information.  Because  DLA  did  not  follow  the  guidance  in  the  DoD 
Management  Plan  with  respect  to  identifying  all  interfaces  and  developing 
interface  agreements,  DLA  risks  being  unable  to  perform  its  operational  mission 
in  the  Y2K  environment. 

Interface  Definition.  The  DoD  Management  Plan  defines  an  interface  as  “a 
boundary  across  which  two  systems  communicate.”  In  addition,  the  DoD 
Management  Plan  explains  that  “  an  interface  might  be  a  hardware  connector  used 
to  link  to  other  devices,  or  it  might  be  a  convention  used  to  allow  communication 
between  two  software  systems.”  External  interfaces  are  defined  as  interfaces  that 
are  outside  of  the  Component.  Internal  interfaces  are  defined  as  interfaces  that  are 
within  the  Component. 

Interface  Strategy.  The  DLA  strategy  for  external  (non-DLA)  interfaces  consists 
of  establishing  interface  agreements  that  focus  on  whether  the  current  interfaces 
change  date  formats.  If  interfaces  change  date  formats,  the  DLA  strategy  is  to 
concentrate  on  building  bridges  to  accommodate  the  modified  interface  and 
ensuring  that  Y2K  trigger  dates  are  transmitted  through  the  interface.  Y2K  trigger 
dates  are  those  dates  that  have  been  identified  as  having  the  potential  to  cause  a 
computational  error  due  to  the  representation  of  the  year  2000.  They  include 
01-01-00  and  02-29-00.  If  interface  date  formats  do  not  change,  the  DLA  strategy 
focuses  on  identification  and  testing  of  trigger  dates.  The  DLA  strategy  for 
internal  interfaces  places  the  responsibility  for  any  change  in  format  of  interfaces 
on  the  changing  system.  The  changing  systems  will  coordinate  the  change  with 
other  interface  partners  and  document  the  requirement  with  a  software  change 
requirement. 

Interface  Identification.  The  DLA  Y2K  management  documents  did  not 
consistently  identify  or  categorize  mission-critical  interface  partners.  The  DoD 
Management  Plan  requires  that  all  external  interfaces  be  identified  during  the 
assessment  phase  (Phase  II)  of  the  five  management  phases.  The  required 
completion  date  for  the  assessment  phase  was  June  1997.  Although  the  DSS 
Program  Office  provided  us  with  interface  agreements,  testing  plans,  and 
certification  strategy,  we  were  unable  to  ascertain  whether  all  interfaces  had  been 
identified.  For  instance,  DSS  Program  Office  personnel  identified  three  DSS 
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external  interfaces  to  the  audit  team  on  September  3, 1998.  However,  the  DSS 
Program  Office  provided  an  email  list  of  external  interfaces  on  September  29, 
1998,  that  contained  not  only  those  three  interfaces  but  also  an  additional  nine 
interfaces.  An  interface  agreement  was  provided  for  each  of  those  12  interfaces. 

A  list  of  seven  internal  interfaces  was  provided  to  the  audit  team  on 
November  2, 1998.  That  list  of  internal  interfaces  was  from  a  list  labeled  “  CICS 
[Customer  Information  Control  System]  External  Interfaces  for  DSS.”  In  a 
November  12, 1998,  meeting,  DSS  Program  Office  personnel  stated  that  the 
correct  number  of  interfaces  was  13,  regardless  of  whether  they  were  internal  or 
external  interfaces.  Although  the  DSS  Program  Office  had  provided  only 

12  interface  agreements,  DSS  Program  Office  personnel  stated  that  all 

13  interfaces  were  covered  by  interface  agreements.  On  November  13, 1998,  the 
DSS  Program  Office  provided  us  with  documentation  that  included  two  additional 
interface  agreements,  bringing  the  total  to  14,  not  13  as  had  been  discussed  in  the 
November  12, 1998,  meeting.  Our  review  of  the  interface  agreements  showed 
that  none  of  the  interface  agreements  were  for  internal  interfaces. 

Documents  provided  by  the  DSS  Program  Office  November  13, 1998,  are 
inconsistent  in  identifying  DSS  interfaces  and  further  complicate  the  status  of 
interface  identification.  One  of  those  documents,  the  “  Distribution  Standard 
System  (DSS)  Year  2000  Follow  On  Interface  Test  Plan”  (Follow  On  Interface 
Test  Plan),  November  13,  1998,  lists  11  external  interfaces  and  3  internal 
interfaces  that  will  be  tested.  Of  those  1 1  external  interfaces,  6  do  not  appear  on 
the  September  29, 1998,  list  of  external  interfaces.  In  addition,  those  six  external 
interfaces  do  not  have  interface  agreements.  Another  of  the  documents  provided 
on  November  13,  1998,  the  “Test  and  Certification  Strategy  for  DSS  Year  2000 
Compliance”  (DSS  Test  and  Certification  Strategy),  October  1998,  provides  a  list 
of  DSS  interfaces  that  is  not  consistent  with  the  Follow  On  Interface  Test  Plan.  In 
addition,  the  DSS  Test  and  Certification  Strategy  document  is  not  internally 
consistent.  Appendix  C  of  the  DSS  Test  and  Certification  Strategy  lists 
13  interfaces  that  require  an  agreement.  That  list  also  contains  eight  Customer 
Information  Control  System  external  interfaces  and  six  DSS  applications. 
However,  page  4  of  the  body  of  the  DSS  Test  and  Certification  Strategy  lists 
12  interfaces  that  require  an  interface  agreement  instead  of  the  13  listed  in  the 
appendix.  Additionally,  neither  of  the  lists  in  the  DSS  Test  and  Certification 
Strategy  matches  the  September  29, 1998,  list  of  external  interfaces.  A  detailed 
comparison  of  the  various  interface  lists  provided  to  the  audit  team  is  in 
Appendix  B. 

Interface  Agreements.  External  interface  agreements,  according  to  the  DoD 
Management  Plan,  must  contain  the  following  minimum  information: 

•  names  of  interfacing  systems; 

•  description  of  interface  (including  data  set  and  data  file  name); 

•  interface  strategy  for  both  sending  and  receiving  systems  (file 
expansion,  procedural  code,  sliding  window,  or  other  specified 
strategy); 
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•  milestone  dates  for  analyses,  programming  testing,  joint  testing,  and 
implementation; 

•  review  and  acceptance  process; 

•  point  of  contact  for  each  interfacing  system,  to  include  organization, 
telephone,  and  email  address;  and 

•  signature  of  point  of  contact  for  each  interfacing  system. 

External  Agreements.  The  DSS  Program  Office  provided  copies  of  interface 
agreements  for  14  external  systems;  12  of  the  interface  agreements  were  provided 
in  October  1998  and  2  additional  agreements  covering  the  Cargo  Movement 
Operations  System  were  provided  on  November  13, 1998. 

A  review  of  the  14  DSS  interface  agreements  disclosed  that  3  met  the  minimum 
requirements  described  in  the  DoD  Management  Plan.  The  following  table 
indicates  the  required  elements  included  in  the  interface  agreements  for  the 
14  external  interfaces. 
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DSS  Interface  Agreements:  Required  Interface  Elements 


System 

Name 

AMCISS1 

CMOS2 

CMOS/AMS3 

CFM4 

CFM/SCDS5 
CAIMS6 
DBMS7 
DQARES8 
SCDS  (D035L)9 
SCDS  (D035R)'0 
SCDS  (D035K)11 
SCS12 

TC-AIMS  II13 
UADPS14 


Review 

Description  Strategy  Milestones  Process 


X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 


X 

XXX 

XXX 

XXX 

XXX 

X  X 

XXX 

X 

X 

X 

X 


XX  X 

X  X 


Point  of 

Contact  Signature 
X  X 

X  X 

X  X 

X 
X 


X 

X  X 

X  X 

X  X 

X  X 

X  X 

X 
X 
X 


'Army  Materiel  Command  Installation  Supply  System 
2Cargo  Movement  Operations  System 

3 Cargo  Movement  Operations  System/Automated  Manifest  System 
4Continental  United  States  Freight  Management  System 

^Continental  United  States  Freight  Management  System/Stock  Control  and  Distribution  System 
^Conventional  Ammunition  Integrated  Management  System 
^Defense  Business  Management  System 

^Distribution  Quality  Assurance  Reporting  and  Evaluation  System 

9Stock  Control  and  Distribution  System/Inventory  and  Storage  Process  (D035L) 

l°Stock  Control  and  Distribution  System/Transportation  Routing  and  Documentation  (D035R) 

1  IStock  Control  and  Distribution  System/Wholesale  and  Retail  Shipping  (D035K) 

12Stock  Control  System 

^Transportation  Coordinators-Automated  Information  for  Movement  Systems  II 
14Uniform  Automated  Data  Processing  System-Stock  Points 


Internal  Interfaces.  Internal  interfaces  are  those  interfaces  that  exist  between 
two  DLA  organizations.  Internal  interfaces  are  also  vulnerable  to  Y2K  problems 
that  could  introduce  or  propagate  errors  from  one  DLA  system  to  another.  As  of 
November  12,  1998,  DLA  had  identified  seven  internal  DSS  interfaces  to  the 
audit  team.  Documents  provided  by  DLA  on  November  13,  1998,  identified 
internal  interfaces  that  did  not  match  the  seven  internal  interfaces  previously 
identified  (see  Appendix  B).  Although  the  DoD  Management  Plan  does  not 
require  interface  agreements  between  internal  interface  partners,  the  evident 
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confusion  over  identifying  those  internal  DSS  interfaces  increases  the  risk  that 
internal  interfaces  may  not  be  identified,  tested,  and  certified  as  Y2K  compliant. 
In  response  to  the  draft  report,  DLA  stated  that  all  interfaces  were  identified  in  the 
Follow  On  Interface  Test  Plan  dated  November  13, 1998.  However,  as  of 
January  31, 1999,  DLA  had  not  explained  the  disparity  between  the  interfaces 
listed  in  that  document  and  the  14  interface  agreements  provided  to  us. 

Importance  of  Interfaces.  Accurate  data  exchanges  with  all  interface  partners 
are  critical  to  the  successful  operation  of  DSS.  AIS  interface  identification,  along 
with  properly  prepared  interface  agreements,  must  be  in  place  to  ensure  accurate 
data  exchanges.  Those  agreements  also  facilitate  the  preparation  of  the  plans  for 
Y2K  testing  required  by  the  Deputy  Secretary  of  Defense  memorandum,  “  Year 
2000  (Y2K)  Verification  of  National  Security  Capabilities.”  In  addition,  the  DoD 
Management  Plan  requires  that  all  interfaces  be  tested  and  certified  prior  to  exit 
from  tiie  validation  phase  (Phase  IV)  of  the  five  phases  of  Y2K  management. 
According  to  the  schedule  in  the  DoD  Management  Plan,  DSS  as  well  as  other 
mission-critical  automated  systems  were  to  have  completed  the  validation  phase 
by  September  30,  1998.  In  view  of  the  deficiencies  in  the  identification  of  key 
interface  data,  DLA  risks  being  unable  to  perform  its  operational  mission  in  the 
Y2K  environment. 


Testing 


The  overall  DSS  Y2K  test  and  certification  process  followed  by  DLA  and  the 
Y2K  management  process  followed  by  DISA  did  not  provide  adequate  support  for 
DLA  to  certify  that  DSS  was  Y2K  compliant.  Although  DLA  implemented  a 
Y2K  program  for  DSS  and  performed  testing  of  Y2K  critical  dates,  interrelated 
management  conditions  at  DLA  and  DISA  as  of  November  1998  could  have 
prevented  DLA  from  certifying  that  DSS  was  Y2K  compliant  by  the  target  date  of 
December  31, 1998.  DLA  met  the  December  31, 1998,  target  date,  but  the 
certification  was  based  on  the  validation  testing  completed  November  20,  1998. 
DLA  did  not  conduct  interface  testing  or  an  operational  assessment  in  support  of 
the  certification. 

Test  Planning  and  Execution.  DLA  initiated  testing  of  DSS  for  Y2K 
compliance  and  implemented  a  program  to  monitor  the  testing  of  hardware  and 
software  located  at  18  depots.2  As  part  of  the  DSS  testing  strategy,  DLA  included 
developmental  testing,  operational  assessment,  follow-on  interface  testing,  and 
time  machine  testing.  However,  DLA  did  not  document  all  of  the  testing 
schedules  and  test  plans  for  DSS,  as  required  in  the  DLA  “Test  and  Certification 
Process  for  Year  2000  Compliance  of  Automated  Information  Systems,”  April 
1998.  In  addition,  the  tests  may  not  support  the  certification  of  DSS  as  Y2K 
compliant. 


2DSS  has  been  implemented  at  18  distribution  depots  in  the  continental  United  States.  Two  distribution 
depots,  located  outside  the  continental  United  States,  are  scheduled  for  DSS  implementation  in  FY  1999. 
Two  additional  depots  located  in  the  continental  United  States  have  been  privatized  and  do  not  use  DSS. 
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Developmental  Testing.  DLA  prepared  a  developmental  test  plan  that 
was  executed  by  DSDC,  Ogden.  The  developmental  testing  described  in  the  plan 
was  intended  to  verify  that  DSS  accurately  processes  10  of  the  dates  identified  by 
DoD  as  being  critical  for  testing  Y2K  compliance.  Interface  testing  was  included 
in  the  plan.  However,  DSDC  personnel  stated  that  the  interface  testing  was 
conducted  using  simulations  that  demonstrated  that  DSS  properly  processed  Y2K 
dates.  That  simulated  interface  testing  did  not  involve  point-of-origin  testing  or 
actual  use  of  the  interface.  Although  the  DoD  Management  Plan  allows  systems 
to  rely  on  simulation  testing  when  operational  constraints  preclude  direct  testing 
with  interface  partners,  DLA  did  not  identify  any  operational  conditions  that 
would  preclude  testing  DSS  directly  with  interface  partners.  The  developmental 
testing,  completed  on  November  20, 1998,  was  to  be  used  as  the  basis  for 
certifying  that  DSS  is  Y2K  compliant.  As  a  result  of  our  concerns  with  the 
adequacy  of  the  DSDC  execution  of  interface  testing  for  Y2K  certification,  DSDC 
developed  the  Follow  On  Interface  Test  Plan. 

Operational  Assessment.  DLA  might  not  have  had  time  to  adequately 
address  operational  issues  not  covered  during  the  developmental  testing  of  DSS  to 
meet  the  December  31, 1998,  deadline  for  completion  of  the  implementation 
phase  (Phase  V)  of  all  mission-critical  DoD  systems.  DLA  planned  to  conduct  an 
operational  assessment  of  DSS  using  the  services  of  an  independent  contractor  in 
order  to  verify  that  DSS  can  perform  its  operational  mission  in  the  Y2K 
environment.  The  scope  of  the  operational  assessment  had  not  been  determined 
or  an  operational  assessment  plan  prepared  as  of  November  13,  1998.  DLA 
explained  that  an  assessment  plan  would  be  developed  after  the  data  gathered 
during  the  developmental  testing  was  analyzed  to  determine  if  additional  testing 
would  be  required  during  the  operational  assessment.  If  additional  testing  was 
required,  we  believe  that  insufficient  time  remained  to  conduct  the  testing.  In 
addition,  test  resources  had  not  been  identified.  DLA  should  prepare  an 
operational  assessment  plan  that  identifies  the  scope  of  the  effort  and  any 
additional  resources  required. 

Follow-On  Interface  Testing.  We  believe  DLA  did  not  have  sufficient 
time  to  adequately  test  DSS  interfaces  in  order  to  certify  Y2K  compliance  by 
December  31, 1998.  DLA  had  only  begun  discussions  with  its  interface  partners 
in  November  1998.  All  interfaces  had  not  been  identified  and  documented  in 
interface  agreements  as  of  November  1998.  In  addition,  interface  testing  was  not 
part  of  the  DLA  testing  strategy  that  supports  DSS  Y2K  certification.  The  DSS 
certification  strategy  called  for  using  simulation  testing  conducted  during 
developmental  testing  as  the  basis  for  certifying  that  DSS  is  Y2K  compliant.  In 
view  of  the  deficiencies  in  the  identification  of  interfaces  and  key  interface  data, 
the  simulation  testing  would  not  provide  an  adequate  basis  for  certifying  that  DSS 
is  Y2K  compliant  and  able  to  perform  the  operational  mission  for  which  it  was 
intended. 

Time  Machine  Testing.  DLA  had  not  defined  the  purpose  or  scope  of 
time  machine  testing  as  of  November  1998,  and  had  planned  on  conducting  that 
testing  after  the  December  31, 1998,  deadline  for  exit  from  the  implementation 
phase  (Phase  V)  of  Y2K  management.  In  the  DSS  Test  and  Certification  Strategy 
document,  the  stated  objective  of  the  time  machine  testing  is  “to  ensure  that  DISA 
can  effectively  support  DSS  core  logistics  business  functions  in  a  DISA  certified 
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environment  over  the  full  range  of  Y2K  problem  dates.”  The  DoD  Management 
Plan  states  that  the  final  phase  of  the  multi-phase  testing  and  validation  process  is 
acceptance  testing.  During  acceptance  testing  the  entire  information  system- 
including  data  interfaces-is  tested  with  operational  data.  Additionally,  in  order  to 
exit  the  validation  phase,  the  system  must  be  tested  on  a  compliant  domain  and  in 
an  operationally  compliant  environment.  However,  DLA  indicated  that  time 
machine  testing  would  not  be  conducted  until  March  1999  and  as  of  November 
1998  had  only  recently  started  discussions  with  DMC,  Ogden,  regarding  the 
testing  to  be  performed.  As  a  result,  DLA  would  not  have  time  to  perform  the 
testing  required  to  certify  DSS  as  Y2K  compliant  prior  to  December  31,  1998. 
Again,  DLA  met  the  December  31, 1998,  target  date  but  did  not  conduct  interface 
testing  or  an  operational  assessment  in  support  of  the  certification. 


DSS  Test  and  Production  Domains 


The  overall  Y2K  test  and  certification  process  followed  by  DLA  and  the  Y2K 
management  process  followed  by  DISA  did  not  provide  adequate  assurance  or 
support  for  DLA  to  certify  that  DSS  is  Y2K  compliant.  DLA  did  not  identify  and 
use  a  DSS  test  domain3  that  was  Y2K  compliant.  The  developmental  testing 
completed  November  20,  1998,  was  not  conducted  on  a  Y2K  compliant  domain. 
Further,  the  DSS  production  domain  would  require  a  waiver  to  be  considered 
compliant.  In  addition,  the  DMC  domain  status  reports  were  not  a  reliable  source 
for  determining  Y2K  status. 

Role  of  Megacenters  and  Domains.  DMCs  are  the  primary  providers  of 
mainframe  computer  services  to  functional  users  in  the  Army,  the  Navy,  the  Air 
Force,  the  Marine  Corps,  and  the  Defense  agencies.  The  systems  that  run  on  a 
mainframe  computer  operate  in  a  logical  partition  called  a  “  domain.”  DMCs  are 
responsible  for  the  Y2K  compliance  of  the  computer  hardware  and  the  executive 
software.  The  Central  Design  Activities  that  are  organizationally  part  of  the 
Services  and  Defense  agencies  are  responsible  for  developing  and  maintaining  the 
application  software  and  making  the  application  software  work  within  a  domain 
running  at  the  DMCs. 

Test  Domain.  DLA  did  not  perform  the  testing  to  be  used  as  the  basis  for 
DSS  Y2K  certification  in  a  Y2K  compliant  test  domain.  The  test  domain  was  not 
compliant  because  the  executive  software  and  a  compiler  for  the  DSS  domains 
were  not  Y2K  compliant.  A  domain  includes  the  system  application,  its  data,  and 
the  executive  software.  DMC,  Ogden,  has  one  DSS  test  and  development  domain 
and  three  production  domains  that  support  the  distribution  depots.  As  of 
January  31, 1999,  none  of  the  DSS  domains  were  fully  Y2K  compliant.  The  DoD 
Management  Plan  requires  that  a  system  must  be  tested  on  a  compliant  domain 
and  in  an  operationally  compliant  environment  in  order  to  exit  the  validation 
phase.  Therefore,  the  developmental  tests  of  DSS  were  not  performed  in  a  Y2K 
compliant  domain,  which  would  prevent  DLA  from  certifying  DSS  as  Y2K 
compliant. 


3The  logical  partition  that  ran  the  DSS  application  during  testing  was  the  test  domain.  The  logical  partition 
that  runs  the  DSS  application  on  a  day-to-day  basis  is  the  production  domain. 
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Production  Domain.  Although  DMC,  Ogden,  anticipated  that  the 
software  on  the  production  domains  would  be  Y2K  compliant  by  using  patches 
and  software  upgrades,  the  DSS  compiler  cannot  be  made  Y2K  compliant.  The 
DSS  compiler  uses  COBOL  programming  language,  which  is  also  the  DSS 
programming  language.  However,  technical  constraints  preclude  the  compiler 
from  being  updated  or  modified  to  achieve  Y2K  compliance.  DMC,  Ogden, 
advised  the  audit  team  that  a  Y2K  compliant  compiler  is  available.  However, 
using  the  compliant  compiler  is  not  a  viable  option  because  it  would  require  a 
substantial  rewrite  of  the  DSS  code  to  another  programming  language.  In 
addition,  there  are  technical  deficiencies  with  the  Y2K  compliant  compiler.  DLA 
created  a  “work-around”  for  the  compiler  problem  that  uses  a  sliding  window 
technique  that  will  convert  the  compiler’s  two-digit  date  to  the  required  DSS 
four-digit  format.  Because  DLA  implemented  the  work-around,  DLA  determined 
that  the  noncompliant  compiler  will  not  adversely  affect  DSS  capability  to  process 
Y2K  dates.  DMC,  Ogden,  advised  DSDC,  Ogden,  that  DSS  must  have  a  waiver 
from  the  Secretary  of  Defense  in  order  to  keep  the  noncompliant  compiler. 

The  Office  of  the  Secretary  of  Defense  granted  a  waiver  to  DLA  on  January  5, 
1999,  that  stated  “the  DSS  . . .  may  be  considered  compliant  with  the  current 
workarounds  and  disabling  of  non-compliant  applications  on  the  same  platform.” 
That  waiver  also  directed  DLA  to  request  that  DISA  expedite  the  installation  of 
Y2K  compliant  products  no  later  than  the  third  quarter  of  calendar  year  1999.  In  a 
separate  waiver,  also  dated  January  5,  1999,  the  Office  of  the  Secretary  of  Defense 
granted  DSS  a  waiver  for  use  of  noncompliant  software.  The  COBOL  compiler 
was  specifically  cited  as  part  of  the  waiver.  The  software  waiver  directed  that 
DLA  develop  a  migration  plan  for  movement  off  the  COBOL  compiler  to  a  Y2K 
compliant  product  and  provide  a  quarterly  status  report  on  the  migration  effort  to 
the  Office  of  the  Secretary  of  Defense.  The  waiver  required  that  all  Y2K 
compliant  products  be  tested  and  installed  free  of  charge  to  the  customer  by 
the  second  quarter  of  calendar  year  2000.  Copies  of  the  waivers  are  in 
Appendix  C. 

Reliability  of  Domain  Y2K  Status.  The  Y2K  status  of  domains  reported  by 
DMC,  Ogden,  was  unreliable  due  to  errors  in  the  spreadsheets  compiled  by  DMC, 
Ogden.  DMC,  Ogden,  maintains  spreadsheets  that  identify  the  executive  software 
attributable  to  each  domain  and  uses  those  spreadsheets  to  monitor  the  Y2K  status 
of  software  associated  with  a  domain. 

On  November  19,  1998,  DMC,  Ogden,  provided  spreadsheets  of  the  Y2K  status 
of  the  executive  software  associated  with  the  DSS  domains  located  at  that  DMC. 
Upon  receiving  the  spreadsheets,  we  contacted  DMC,  Ogden,  personnel  to 
confirm  our  understanding  of  the  spreadsheets  and  to  validate  our  conclusion  that 
none  of  the  DSS  domains  were  Y2K  compliant  because  each  domain  reported  at 
least  one  type  of  noncompliant  executive  software.  We  provided  a  copy  of  the 
spreadsheets  to  the  DLA  point  of  contact  that  monitors  the  Y2K  status  of  the 
software.  DLA  determined  that  the  spreadsheets  were  inaccurate  and  notified 
DMC,  Ogden,  that  the  spreadsheets  were  inaccurate.  In  response  to  the  reported 
inaccuracy,  DMC,  Ogden,  personnel  explained  that  they  had  erroneously 
attributed  a  type  of  executive  software  to  DSS  that  is  not  applicable  to  the  DSS 
domain.  The  executive  software  that  was  erroneously  attributed  to  the  DSS 
domain  was  reported  on  the  spreadsheets  as  being  Y2K  noncompliant.  Such 
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inaccurate  reporting  of  the  Y2K  status  of  domains  can  be  misleading  in  assessing 
the  Y2K  capability  of  DSS  or  other  systems  to  perform  their  operational  mission 
in  the  Y2K  environment. 


DISA  Test  Agreements 


The  test  agreement  between  DISA  and  DLA  did  not  meet  the  intent  of  the  DoD 
policy. 

Secretary  of  Defense  Policy.  The  Secretary  of  Defense  issued  a  memorandum  on 
August  7, 1998,  stating  that  DoD  was  making  insufficient  progress  in  its  effort  to 
solve  its  Y2K  computer  problems.  To  improve  the  accountability  for  corrective 
actions,  the  Secretary  of  Defense  directed  that  several  actions  be  taken.  One  of 
those  actions  required  that  the  Military  Departments,  commanders  in  chief,  and 
Defense  agencies  be  responsible  for  ensuring  that  effective  October  1, 1998,  funds 
are  not  obligated  for  any  domain  user  in  a  DISA  megacenter  if  that  domain  user 
has  failed  to  sign  all  associated  explicit  test  agreements  with  DISA. 

DSS  Test  Agreement.  Although  DISA  and  DLA  signed  a  “Memorandum  of 
Agreement  for  Defense  Information  Systems  Agency  Y2K  Testing  Support  for 
the  Defense  Logistics  Agency  (DLA),”  September  24,  1998,  that  agreement  is 
not  an  explicit  test  agreement.  The  agreement  is  not  specific  to  DSS  or  other 
DLA  systems.  It  also  does  not  identify  test  schedules,  testing  strategy,  or 
resources  required  by  system  or  test  event.  The  agreement  states  that  “  DLA 
and  DISA  agree  to  coordinate  Y2K  testing  strategies,  schedules  and,  as  needed, 
development  of  appropriate  Y2K  test  procedures.”  The  agreement  appears  to  be  a 
generic  attempt  to  address  all  DLA  systems.  Other  than  state  that  DLA  and 
DISA  will  coordinate,  the  agreement  does  not  provide  explicit  information  and 
therefore  does  not  meet  the  intent  of  the  Secretary  of  Defense  policy.  Without 
system-specific  agreements  between  DLA  and  DISA,  those  agencies  will  not  be 
able  to  effectively  coordinate  and  plan  the  testing  required  to  ensure  that  DSS  and 
other  systems  are  Y2K  compliant. 


Contingency  Plans 


DLA  has  taken  positive  steps  to  ensure  that  DSS  Y2K  risks  are  identified  and 
managed  in  contingency  planning  for  the  materiel  management  mission.  As  of 
October  30,  1998,  DDC  had  a  draft  contingency  plan  for  DSS  (called  a  business 
continuity  plan)  that  contained  the  basic  elements  required  for  contingency 
planning  outlined  in  the  DoD  Management  Plan. 

Definition  of  Contingency  Plan.  The  DoD  Management  Plan  provides  the 
following  definition  of  a  contingency  plan:  “A  plan  for  responding  to  the  loss  or 
unacceptable  degradation  of  system  use  due  to  Y2K-related  disruptions  to  the 
application  software,  database,  operating  system,  network,  infrastructure  or 
environment.” 
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Management  Action.  During  the  audit,  DDC  made  significant  progress  in 
developing  and  refining  the  DSS  business  continuity  plan.  In  September  1998, 
we  reviewed  an  early  draft  of  the  DSS  business  continuity  plan.  We  noted  that  the 
focus  appeared  to  be  on  disaster  recovery  (flood,  fire,  and  file  like)  rather  than 
system  failure  due  to  the  Y2K  problem  that  would  have  the  potential  to  also  infect 
designated  disaster  backup  sites.  As  a  result  of  our  discussion  with  the  DDC 
command  group  and  the  additional  DoD  focus  on  contingency  planning, 
contingency  planning  was  added  to  the  agenda  at  the  DDC  Commanders 
Conference  held  during  the  third  week  of  October  1998.  In  addition,  DDC 
conducted  a  workshop  on  business  continuity  requirements  during  the  week  of 
November  17, 1998.  DDC  also  tasked  the  distribution  depots  to  update  the 
existing  contingency  plans  and  risk  assessments  in  keeping  with  the  most  recent 
DoD  and  DLA  guidance.  The  deadline  for  completion  of  the  updated  plan  was 
November  30, 1998,  with  initial  depot  input  required  by  October  30, 1998.  Our 
review  of  the  October  30, 1998,  version  of  the  updated  draft  contingency  plan 
showed  that  the  revised  plan  included  risk  assessments  and  provided  the  basic 
structure  and  requirements  for  contingency  planning  that  are  listed  in  the  DoD 
Management  Plan. 

DLA  has  recognized  the  important  linkage  between  developing  contingency  plans 
and  continuity  of  operations,  and  has  taken  action  to  ensure  that  the  focus  for 
DSS,  as  well  as  other  mission-critical  systems,  is  on  the  development  of 
functional  plans  that  will  ensure  continued  performance  of  the  operational 
mission.  DLA  CIO  memorandum,  “  CIO  Letter  98-34,  Year  2000  Business 
Continuity  and  Contingency  Planning,”  August  6,  1998,  states  that  “the  objective 
of  business  continuity  and  contingency  planning  was  to  have  plans  in  place  to 
ensure  the  continuation  of  core  business  processes  in  the  event  of  an  information 
technology  failure  caused  by  Y2K  problems  in  application  software,  systems 
software,  embedded  microcircuit  code,  and  the  like.” 

Definition  of  Continuity  of  Operations.  The  “  Capstone  Operational 
Assessment  Plan  for  Logistics  Systems  Year  2000”  (the  Capstone  Plan)  was 
released  October  21,  1998,  by  the  Under  Secretary  of  Defense  by  memorandum. 
The  Capstone  Plan  defines  a  continuity  of  operations  plan  as: 

a  set  of  contingency  plans,  with  a  single  plan  for  each  mission-critical 
function.  Continuity  of  operations  plans  focus  on  maintaining  mission 
or  function  capability  by  alternate  means  including  automated 
replacement,  semi-automated  replacement  or  manual  replacement  of 
primary  automated  systems.  The  alternate  means  are  developed  in 
response  to  impact  analysis  resulting  from  the  failure  of  internal  and 
external  information  systems  or  loss  of  infrastructure  services,  e.g. 
electrical  services.  Proving  the  viability  of  contingency  plans  or 
functional  continuity  of  operations  plan  will  be  integrated  with  end-to- 
end  assessments  where  possible.  .  .  .  Components  will  develop  a 
Continuity  of  Operations  plan  for  each  function  with  a  goal  of 
maximizing  the  functionality  and  speed  of  resumption  of  operations, 
including  defining  triggers  for  activating  the  plan.  The  plan  should 
provide  a  description  of  resources,  staff  roles,  procedures,  and 
timetables  needed  for  implementation. 
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Continuity  of  Operations  Plan  for  Materiel  Management.  DLA  was 
developing  a  contingency  plan  for  the  materiel  management  functional  area  that 
might  be  more  appropriately  labeled  a  continuity  of  operations  plan  according  to 
the  definition  of  continuity  of  operations  plans  in  the  Capstone  Plan.  The  materiel 
management  functional  area  includes  the  functions  performed  by  DSS  in  support 
of  the  distribution  depots  as  part  of  the  overall  DLA  logistics  mission.  The  DSS 
contingency  plan  that  DDC  was  refining  as  of  November  13, 1998,  was  to  be 
composed  of  contingency  plans  for  each  distribution  depot  and,  taken  together, 
would  form  one  part  of  the  overall  materiel  management  plan. 

The  “Business  Continuity  and  Contingency  Plan,  Year  2000,”  was  approved  by 
the  DDC  commander  on  November  24, 1998,  meeting  the  November  30, 1998, 
milestone  for  completion  of  the  business  contingency  plan. 


Recommendations,  Management  Comments,  and  Audit 
Response 

1.  We  recommend  that  the  Director,  Defense  Logistics  Agency: 

a.  Develop  and  implement  a  depot-level  year  2000  checklist. 

DLA  Comments.  DLA  partially  concurred,  stating  that  the  Defense  Logistics 
Support  Command  and  DDC  provided  adequate  guidance  for  the  depots. 
Supplemental  guidance  issued  by  DDC  included  a  Y2K  checklist  to  assist  efforts 
at  the  depot  level.  Facility  reporting  and  in-progress  reviews  are  also  held  on  all 
items  being  checked.  The  assessments  and  reporting  process  serves  to  verify 
information  provided  on  the  checklist. 

Audit  Response.  The  DLA  comments  are  not  fully  responsive.  The  Y2K 
checklist  issued  by  DDC  was  not  a  checklist  but  a  form  for  inventorying 
equipment  and  software.  A  checklist  should  identify  the  hardware  and  suites  of 
software  that  are  compliant  and  noncompliant  for  depots  to  use  as  a  reference  for 
upgrading  their  equipment  and  software.  Such  a  checklist  would  assist  depots  in 
implementing  equipment  and  software  that  is  Y2K  compliant.  Therefore,  we 
request  that  DLA  develop  a  checklist  that  will  ensure  consistent  implementation  at 
the  depot  level  and  provide  us  a  copy  in  response  to  the  final  report. 

b.  Complete  the  inventory  of  all  Distribution  Standard  System 
interfaces  and  prepare  interface  agreements  that  contain  the  required  data 
elements  for  all  mission-critical  interfaces. 

DLA  Comments.  DLA  partially  concurred,  stating  that  the  original  inventory 
was  completed  in  September  1998,  but  that  in  preparing  for  follow-on  interface 
testing,  three  additional  interfaces  requiring  memorandums  of  agreement  were 
identified.  All  interfaces  were  identified  in  the  Follow  On  Interface  Test  Plan. 

Audit  Response.  The  DLA  comments  are  not  fully  responsive.  As  of 
November  13, 1998,  DLA  had  provided  us  with  copies  of  14  interface 
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agreements.  Those  14  agreements  did  not  correspond  to  the  interfaces  listed  in 
the  Follow  On  Interface  Test  Plan.  DLA  did  not  provide  an  explanation  for  the 
disparity  between  the  14  interface  agreements  and  the  inventory  of  interfaces 
listed  in  the  November  13, 1998,  interface  test  plan.  DLA  needs  to  reconcile  that 
disparity  and  provide  us  with  copies  of  interface  agreements  not  previously 
provided.  Additionally,  DLA  did  not  address  the  lack  of  required  data  elements  in 
the  content  of  the  14  interface  agreements.  We  request  that  DLA  provide  the 
additional  information  in  response  to  this  final  report. 

c.  Include  the  complete  inventory  of  interfaces  in  the  follow-on 
interface  testing  prior  to  year  2000  certification. 

DLA  Comments.  DLA  nonconcurred,  stating  that  DSS  is  a  compliant  production 
system.  As  part  of  the  validation  testing,  examples  of  all  interface  transactions 
were  simulated  to  DSS.  Additional  interface  testing  will  be  accomplished  during 
the  logistics  end-to-end  tests.  DLA  further  stated  that  there  was  no  missing 
interface  inventory  identified  in  the  Follow  On  Interface  Test  Plan.  The 
memorandum  of  agreement  for  the  last  interface  was  signed  on  December  22, 
1998,  and  DSS  was  certified  as  Y2K  compliant  on  December  30,  1998. 

Audit  Response.  The  DLA  comments  are  not  responsive  because  a  sufficient 
explanation  was  not  provided  for  the  disparity  between  the  14  interface 
agreements  we  reviewed  and  the  list  of  interfaces  contained  in  the  Follow  On 
Interface  Test  Plan.  We  request  that  DLA  provide  us  a  list  of  the  interfaces  that 
were  tested,  the  dates  that  they  were  tested,  and  how  those  tested  interfaces  relate 
to  the  14  interface  agreements  provided  to  us  as  of  November  13, 1998. 

d.  Develop  a  comprehensive  test  plan  and  schedule  for  the 
operational  assessment  and  time  machine  testing. 

DLA  Comments.  DLA  concurred,  stating  that  the  DLA  test  and  certification 
process  requires  test  plans  for  systems.  The  Defense  Distribution  Systems 
Center  provided  status  reports  and  a  final  Y2K  certification  package  with  a  test 
plan.  DLA  also  stated  that  it  had  requested  a  proposal  from  DISA  for  conducting 
time  machine  testing  and  logistics  end-to-end  testing  during  the  March  through 
June  1999  time  frame  in  order  to  satisfy  operational  assessment  and  time  machine 
testing. 

Audit  Response.  The  DLA  comments  are  partially  responsive.  Test  plans  for 
the  software  acceptance  test  completed  on  November  20, 1998,  have  been 
provided.  However,  a  comprehensive  test  plan  for  the  operational  assessment 
and  time  machine  testing  have  not  been  provided.  Because  DISA  is  not  the  user 
of  DSS,  it  has  a  secondary  role  in  developing  a  test  proposal  or  plan  for  the  time 
machine  testing  or  logistics  end-to-end  testing  of  DSS.  Therefore,  we  request  that 
DLA,  as  the  user  of  DSS,  develop  and  provide  a  test  plan  as  well  as  schedule  for 
the  operational  assessment  and  time  machine  testing  for  DSS. 
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2.  We  recommend  that  the  Director,  Defense  Logistics  Agency,  in 
conjunction  with  the  Director,  Defense  Information  Systems  Agency: 

a.  Ensure  that  the  test  domain  is  year  2000  compliant  prior  to  the 
certification  of  the  Distribution  Standard  System  as  year  2000  compliant. 

DISA  Comments.  DIS A  concurred,  indicating  that  the  test  domain  would  be 
compliant  by  January  31,  1999. 

DLA  Comments.  DLA  nonconcured,  stating  that  it  had  secured  a  waiver  from 
the  Office  of  the  Secretary  of  Defense  that  allows  DSS  to  be  certified  as  Y2K 
compliant  based  on  the  testing  already  conducted.  The  noncompliant  products  in 
the  test  domain  were  products  not  used  by  DSS. 

Audit  Response.  The  DLA  comments  are  partially  responsive.  The  waiver 
granted  to  DLA  by  the  Office  of  the  Secretary  of  Defense  on  January  5, 1999, 
stated  “  the  DSS . . .  may  be  considered  compliant  with  the  current  workarounds 
and  disabling  of  non-compliant  applications  on  the  same  platform.”  That  waiver 
also  directed  DLA  to  request  that  DISA  expedite  the  installation  of  Y2K 
compliant  products  no  later  than  the  third  quarter  of  calendar  year  1999.  In  a 
separate  waiver,  the  Office  of  the  Secretary  of  Defense  directed  that  DLA  develop 
a  migration  plan  for  movement  off  the  COBOL  compiler  to  a  Y2K  compliant 
product  and  provide  a  quarterly  status  report  on  the  migration  effort  to  the  Office 
of  the  Secretary  of  Defense.  In  addition,  DLA  was  directed  to  maintain  a 
configuration  control  log  that  showed  where  the  Y2K  noncompliant  products  are 
installed  and  orchestrate  their  replacement.  We  request  that  DLA  provide  an 
explanation  of  the  work-arounds  or  procedures  to  disable  noncompliant  software 
residing  on  the  DSS  domains.  We  also  request  that  DLA  provide  a  copy  of  the 
migration  plan  for  movement  off  COBOL  and  a  copy  of  the  configuration  control 
log  required  under  the  terms  of  both  waivers. 

b.  Validate  that  the  year  2000  status  reported  for  the  Defense 
Mcgacenter  domains  is  accurate  and  that  the  status  of  software  attributed  to 
each  domain  is  accurate. 

DISA  Comments.  DISA  concurred,  explaining  that  it  had  teams  examine  and 
perform  quality  control  checks  on  each  copy  of  the  database  used  by  the 
megacenters  to  generate  spreadsheets  of  the  Y2K  status  of  the  executive  software 
associated  with  each  DSS  domain  located  at  a  megacenter.  In  addition,  DISA 
established  a  configuration  management  branch  to  administer  stringent  policies 
and  procedures  for  access,  population,  and  use  of  the  database.  Further,  as  of 
December  1998,  DISA  began  submitting  monthly  Y2K  compliant  domain  status 
reports  to  the  Office  of  the  Secretary  of  Defense. 

Audit  Response.  The  DISA  comments  are  partially  responsive.  Subsequent 
to  receiving  the  DISA  comments  to  the  draft  report,  we  met  with  DISA  on 
January  21, 1999,  concerning  the  database.  DISA  explained  that  the  domain 
status  in  the  database  did  not  match  the  status  information  contained  in  the 
monthly  status  reports  provided  to  the  Office  of  the  Secretary  of  Defense  because 
the  database  was  not  yet  updated  to  provide  an  accurate  account  of  the  Y2K 
domain  status.  Also,  DLA  and  other  domain  users  did  not  have  direct  on-line 
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access  to  the  database.  In  order  to  review  domain  status,  the  domain  users  must 
request  status  reports.  We  are  pursuing  issues  related  to  the  domain  status 
reporting  in  other  ongoing  reviews  by  this  office.  No  further  DISA  comments  on 
this  recommendation  are  required  in  support  of  this  report. 

DLA  Comments.  DLA  concurred,  stating  that  it  had  validated  the  accuracy  of 
the  Y2K  status  of  software  in  each  megacenter  domain  that  runs  DSS. 

c.  Obtain  a  waiver  for  the  compiler  associated  with  the  Distribution 
Standard  System  test  and  production  domains. 

DISA  Comments.  DISA  concurred,  explaining  that  DLA  is  responsible  for  the 
COBOL  compiler  and  is  therefore  the  submitting  organization  for  the  waiver 
request  to  the  Office  of  the  Secretary  of  Defense. 

DLA  Comments.  DLA  concurred,  stating  that  it  secured  a  waiver  from  the 
Office  of  the  Secretary  of  Defense  that  allows  the  use  of  the  COBOL  compiler  for 
DSS. 


d.  Initiate  and  sign  explicit  Distribution  Standard  System  test 
agreements  between  the  Defense  Information  Systems  Agency  megacenters 
and  the  Defense  Logistics  Agency  as  required  by  Secretary  of  Defense  policy 
of  August  7, 1998. 

DISA  and  DLA  Comments.  DISA  concurred,  stating  that  it  had  signed 
memorandums  of  agreement  with  its  major  customers  that  cover  Y2K  testing 
arrangements.  DLA  partially  concurred,  stating  that  DLA  had  signed  an  explicit 
test  agreement  with  DISA  in  September  1998. 

Audit  Response.  DISA  and  DLA  comments  were  not  responsive.  DISA  does 
not  have  an  explicit  test  agreement  between  the  DISA  megacenters  and  DLA  as 
required  by  the  Secretary  of  Defense  policy.  The  issue  of  compliance  with  the 
intent  of  the  August  1998  guidance  and  of  whether  there  are  more  advisable 
alternatives  than  individual  written  agreements  is  also  being  pursued  separately  by 
the  Inspector  General,  DoD. 
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Appendix  A.  Audit  Process 


This  is  one  of  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  DoD  CIO  to  monitor  DoD 
efforts  to  address  the  Y2K  computing  challenge.  For  a  listing  of  audit  projects 
addressing  this  issue,  see  the  Y2K  webpage  on  IGnet  at  http://www.ignet.gov. 


Scope  and  Methodology 


Work  Performed.  We  reviewed  and  evaluated  the  status  of  the  progress  that 
DLA  had  made  in  resolving  Y2K  computing  issues  for  DSS.  We  evaluated  the 
Y2K  efforts  of  DLA,  compared  those  efforts  described  in  the  DoD  Management 
Plan  issued  by  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  in  April  1997,  the  draft  DoD  Management 
Plan  issued  in  September  1998,  and  the  DoD  Management  Plan,  Version  2, 
December  1998.  We  obtained  documentation  on  system  inventory  status, 
interface  agreements,  and  contingency  plans  available  as  of  November  13, 1998. 
We  also  interviewed  personnel  within  the  DLA  CIO  Y2K  Program  Office,  DSS 
Program  Office,  DDC,  DSDC,  and  four  DLA  distribution  depots  concerning 
Y2K.  We  used  the  information  from  the  interviews  and  documents  to  assess 
efforts  related  to  the  multiple  phases  of  managing  the  Y2K  problem.  In  order  to 
provide  the  most  recent  status  of  the  DSS  Y2K  program,  we  also  interviewed 
personnel  within  DISA,  the  DLA  CIO  Y2K  Program  Office,  DDC,  and  DSDC 
during  the  period  of  December  15, 1998,  through  January  31,  1999. 

Limitation  of  Audit  Scope.  Our  review  did  not  include  nonstandard  computer 
systems  or  applications  that  were  developed  outside  the  purview  of  the  DLA.  We 
did  not  test  Y2K  compliance  of  DLA  AISs.  Our  review  was  limited  to  the  Y2K 
management  process  for  testing  and  contingency  planning  for  DSS. 

DoD-Wide  Corporate  Level  Goals.  In  response  to  the  Government  Performance 
and  Results  Act,  DoD  has  established  6  DoD-wide  corporate-level  performance 
objectives  and  14  goals  for  meeting  the  objectives.  This  report  pertains  to 
achievement  of  the  following  objective  and  goal. 

Objective:  Prepare  now  for  an  uncertain  future.  Goal:  Pursue  a  focused 
modernization  effort  that  maintains  U.S.  qualitative  superiority  in  key  war 
fighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  functional  area  objectives  and 
goals  in  the  Information  Technology  Management  Functional  Area. 

•  Objective:  Become  a  mission  partner.  Goal:  Serve  mission 
information  users  as  customers.  (ITM-1.2) 

•  Objective:  Provide  services  that  satisfy  customer  information  needs. 
Goal:  Modernize  and  integrate  Defense  information  infrastructure.  (ITM-2.2) 


19 


•  Objective:  Provide  services  that  satisfy  customer  information  needs. 
Goal:  Upgrade  technology  base.  (ITM-2.3) 

High-Risk  Area.  In  its  identification  of  risk  areas,  the  GAO  has  specifically 
designated  risk  in  resolution  of  the  Y2K  problem  as  high.  This  report  provides 
coverage  of  that  problem  and  the  overall  Information  Management  and 
Technology  high-risk  area. 

Use  of  Technical  Assistance.  A  computer  engineer  from  the  Software 
Engineering  Branch  of  the  Technical  Assessments  Division,  Inspector  General, 
DoD,  assisted  in  analyzing  the  DSS  domain  software  for  Y2K  compliance. 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit  from 
September  1998  through  January  1999  in  accordance  with  auditing  standards 
issued  by  the  Comptroller  General  of  the  United  States,  as  implemented  by  the 
Inspector  General,  DoD.  We  did  not  use  any  computer-processed  data  for  this 
audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  on  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  the  FY  1998  Annual 
Statement  of  Assurance. 


Summary  of  Prior  Coverage 


The  GAO  and  the  Inspector  General,  DoD,  have  conducted  multiple  reviews 
related  to  Y2K  issues.  GAO  reports  can  be  accessed  over  the  Internet  at 
http://www.gao.gov.  Inspector  General,  DoD,  reports  can  be  accessed  over  the 
Internet  at  http://www.dodig.osd.mil.  The  previous  reports  most  relevant  to  the 
subject  matter  of  this  report  are  listed  below. 


General  Accounting  Office 

GAO  Report  No.  AIMD  97-106,  “Defense  Computers:  Issues  Confronting  the 
Defense  Logistics  Agency  in  Addressing  Year  2000  Problems,”  August  12, 1997. 


Inspector  General,  DoD 

Inspector  General,  DoD,  Report  No.  98-193,  “Evaluation  of  the  Defense 
Megacenters  Year  2000  Program,”  August  25, 1998. 


20 


Appendix  B.  Distribution  Standard 
System  Interfaces 


The  following  table  compares  DSS  interface  identification  by  the  data  source.  On-hand 
interface  agreements  are  those  agreements  that  DLA  had  on  hand  as  of 
November  13,  1998.  The  undocumented  DLA  list  was  a  compilation  of  interface 
information  provided  by  DLA  to  the  audit  team  by  email  or  verbally  prior  to 
November  12,  1998.  Information  shown  in  the  table  under  “DLA  Documented  Interface 
Requirements”  was  taken  from  the  DSS  Test  and  Certification  Strategy  and  the  Follow 
On  Interface  Test  Plan.  Both  of  those  documents  were  provided  to  the  audit  team  by 
DLA  on  November  13, 1998.  Internal  interfaces  do  not  require  interface  agreements. 

Comparison  of  DSS  Interfaces  by  Source 


DLA  Documented 
Interface  Requirements 


✓ 

System  Name 

On-hand 

Interface 

Agreement 

Undocumented 
DLA  List  as  of 
11-12-98 

DSS  Test  and 
Certification 
Strategy  10-98 

Follow  On 
Interface  Test 
Plan  11-13-98 

Army  Materiel  Command 
Installation  Supply  System 

Yes 

External 

Agreement 

required 

External 

Automated  Weight  and  Offer 
Station 

No 

Internal 

CICS  External 

Internal 

Cargo  Movement  Operations 
System 

Yes 

Agreement 

required 

Cargo  Movement  Operations 
System/Automated 

Manifest  System 

Yes 

Agreement 

required 

Continental  United  States 
Freight  Management 

System 

Yes 

External 

Agreement 

required 

Continental  United  States 
Freight  Management 
System/Stock  Control  and 
Distribution 

Yes 

External 

Agreement 

required 

Conventional  Ammunition 
Integrated  Management 

Yes 

External 

Agreement 

required 

System 
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Comparison  of  DSS  Interfaces  by  Source  (cont’d) 


DLA  Documented 
Interface  Requirements 


System  Name 

On-hand 

Interface 

Agreement 

Undocumented 
DLA  List  as  of 
11-12-98 

DSS  Test  and 
Certification 
Strategy  10-98 

Follow  On 
Interface  Test 
Plan  11-13-98 

Defense  Automated 

Addressing  System 

No 

Agreement 

Required 

External 

Defense  Business 

Management  System 

Yes 

External 

Agreement 

Required 

External 

Defense  Logistics 

Information  System 

No 

Internal 

CICS  External 

External 

Dimension  and  Weight 

Station 

No 

Internal 

CICS  External 

Internal 

Distribution  Quality 

Assurance  Reporting  and 
Evaluation  System 

Yes 

External 

Agreement 

required 

Electronic  Data  Exchange 

No 

External 

Equipment  Control  System 

No 

Internal 

DSS  Application 

Internal 

Federal  Express  Power  Ship 

No 

External 

Internet  (Web) 

No 

Internal 

CICS  External 

External 

Inter  System  Application 
Communication  Service 

No 

Internal 

CICS  External 

External 

Standard  Equipment  Control 
System 

No 

CICS  External 

Stock  Control  and 

Distribution 

Yes 

External 

Agreement 

Required 

System  (SCDS)/Inventory 
and  Storage  Process 
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Comparison  of  DSS  Interfaces  by  Source  (cont’d) 


DLA  Documented 

Interface  Requirements 

Svstem  Name 

On-hand 

Interface 

Agreement 

Undocumented 
DLA  List  as  of 
11-12-98 

DSS  Test  and 
Certification 
Strategy  10-98 

Follow  On 
Interface  Test 
Plan  11-13-98 

SCDS/Transportation 

Routing  and 

Documentation 

Yes 

External 

Agreement 

Required 

SCDS/Wholesale  and 

Retail  Shipping 

Yes 

External 

Agreement 

Required 

Stock  Control  System 

Yes 

External 

External 

Transportation 
Coordinators—Automated 
Information  for  Movement 
Systems  II 

Yes 

External 

Agreement 

required 

External 

Uniform  Automated  Data 
Processing  System-Stock 
Points 

Yes 

External 

Agreement 

Required 

External 
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Appendix  C.  Distribution  Standard  System 
Year  2000  Waivers 


OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 
6000  D0ENH  PENTAGON 
WASHINGTON.  DC  SOSOt-SCOO 

5  >M| 


MEMORANDUM  FOR  DIRECTOR,  CHIEF  information  officer,  dla 


SUBJECT:  Granting  ol  Vaivrr  Raquait  for  DSS  and  JTXV 


A  valvar  la  grant ad  for  usa  of  Y2X  compliant  softvara  on 
platforms  that  may  not  ba  fully  Y2K  compliant  for: 

■  The-  Distributed  Standard  System  (DSS)  ,  and; 

•  The  Join  Total  Aaaaaa  Visibility  Systam  (JTAV) , 

The  Distributed  Standard  Syataa  (DSS)  and  JTAV  may  ba 
considered  compliant  with  tha  currant  verKarounda  and  disabling 
of  non-compliant  applications  on  tha  a  ana  platforms.  Tha  3  a 
waivers  are  granted  under  tha  following  stipulations: 

1.  You  will  request  that  DISA  expedite  the  replacement  or 
elimination  of  all  Y2K  non-compllant  producta  vitn  yzk 
compliant  producta,  and  the  YZK  compliant  producta  will 
ba  installed  for  avery  cuseomar  at  no  additional  coat 
to  tha  cuatomax  by  tha  3rd  quartar  of  calendar  year 
1999. 

2.  JTAV  and  DSS  have  been  tasted  and  found  Y2K  compliant 
or  have  workarounds .  As  such  JTAV  and  D5S  may  be 
considered  YZK  compliant,  with  tha  workarounds  and 
disabling  of  non-YZk  compliant  applications. 

*  . 

3.  a  Y2K  non-eowpliant  product  may  reside  on  tha  same 
domein  provided  it  haa  no  interfaces  with  DSS  or  JTAV, 
or  Y2X  non-compliant  applications  have  been  disabled. 

It  is  acknowledged  that  DLA  has  no  direct  authority 
over  the  platform  on  which  JTAV  and  DSS  reside, 
therefore 'it  is  the  responsibility  ef  DISA  to  ensure 
that  continued  raaidanet  of  non-YZK  applications  do  not 
intarfasa  with  033  or  JTAV. 

4.  All  customer!  will  be  advised  of  the  Y2K  non-compllant 
products  on  the  domains  in  question  and  their 
replacement  schedules. 
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S.  The  DIA  Y2K  Office  willmaintain  •  configuration 

control  leg  that  ehove  where  Y2X  non-conipllent  products 
ax#  installed  and  la  responsible  to  orchestrate  the 
replacement  to  ensure  that  it  ia  completed  within  the 
tine  specified  above. 

Y2K  compliance  for  OoD  purposes  includes  compliance  of  all 
interfaces,  even  if  a  contractor  will  not  agree  that  Its  product 
will  be  compliant  et  all  inteifecee. 


With  this  waiver,  the  DIA  may  continue  funding  any  affected 
contracts.  For  additional  information  you  may  contact  Valter 
Banesch,  703-602-0983. 
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OFFICE  OF  THE  ASSISTANT  SECRETARY  OF  DEFENSE 
6000  DEFENSE  PENTAGON 
WASHINGTON,  DC  20301-6000 

‘  S  j»«  isj8 


COMMA.  O.COWTWX. 
COMWWCAIWNJI.A*® 


MEMORANDUM  FOR  DIRECTOR,  CHIEF  INFORMATION  OFFICER,  DLA 

SUBJECT:  Granting  of  Waiver  Request  for  Continued  Use  of  Non- 
Compliant  Y2K  COBOL  OS/VS  and  COBOL  II 


A  waiver  is  chanted  for  use  of  non-Y2K  compliant  software 

for: 

•  Tha  Standard  Automated  Material  Management  System 
(SAMMS) ; 

«  The  Defense  Integrated  Subsistence  Management  System 
(DISMS) l 

•  The  Mechanization  of  Contract  Administration  Services 
(MOCAS) i 

■  The  Defense  Fuels  Automated  Management  System  (DFAMS) ; 

•  Defense  Reutiliiation  and  Marketing  Automated  Information 
System  (DAISY) l 

•  Headquarters  Management  Information  Systems  (HQMIS) ,  and: 

•  The  Distributed  Standard  System  (D55) . 

This  waiver  is  granted  under  the  following  stipulations: 

1.  All  Y2K  non-compliant  products  will  be  replaced  with 
Y2K  compliant  products,  and  the  Y2K  compliant  products 
will  be  installed  for  every  customer  ao  no  additional 
cost  to  the  customer  by  the  second  quarter  of  Calendar 
Year  2000. 

2.  Y2K  compliant  replacement  products  Will  be  installed 
ar.d  tested  for  each  customer.  It  is  required  that  a 
migration  plan  for  movement  off  COBOL  05/VS  and  COBOL 
II  be  accelerated.  A  copy  of  the  migration  plan  with 
schedule  will  be  provided  to  this  office. 

3.  A  Y2K  non-cenpliant  product  may  be  used  or  purchased  if 
it  is  required  for  the  implementation  of  a  Y2K  "fix" 
that  is  a  temporary  solution  until  such  time  as  a 
permanent  Y2K  solution  is  implemented. 

4.  All  customers  will  be  advised  that  they  are  receiving  a 
Y2X  non-compliant  product  that  will  be  replaced  ar.d 
tested  at  no  additional  cost  to  them. 


€1 
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5.  The  DLA  Y2K  Of lice  will  maintain  a  configuration 
control  log  that  shows  where-  Y2K  non-compliant  products 
ara  installed  and  is  responsible  to  orchestrate  the 
replacement  to  ensure  that  it  is  completed  within  the 
time  specified  above. 

6.  OLA  will  report  to  this  office  on  the  first  week  of 
every  calendar  quarter,  the  status  of  the  transition 
from  COBOL  OS/VS  to  alternative  compilers  tot  the 
systems  being  granted  this  waiver. 

Y2K  compliance  for  DoD  purposes  includes  compliance  of  all 
interfaces,  even  if  a  contractor  will  not  agree  that  its  product 
will  be  compliant  at  all  interfaces. 

Kith  this  waiver,  the  DLA  may  continue  funding  any  affected 
.- extracts.  For  additional  information  you  may  contact  Walter 
'i  ,nesch,  703-602-0983. 


2000 
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Appendix  D.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Deputy  Under  Secretary  of  Defense  (Logistics) 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Deputy  Chief  Information  Officer  and  Deputy  Assistant  Secretary  of  Defense  (Chief 
Information  Officer  Policy  and  Implementation) 

Principal  Deputy  -  Y2K 
Assistant  Secretary  of  Defense  (Public  Affairs) 

Department  of  the  Army 

Auditor  General,  Department  of  the  Army 
Inspector  General,  Department  of  the  Army 

Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Navy 
Inspector  General,  Department  of  the  Navy 
Superintendent,  Naval  Postgraduate  School 
Deputy  Naval  Inspector  General  for  Marine  Corps  Matters 

Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Air  Force 
Inspector  General,  Department  of  the  Air  Force 

Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 

Chief  Information  Officer,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 
Inspector  General,  National  Reconnaissance  Office 
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Non-Defense  Federal  Organizations  and  Individuals 


Office  of  Management  and  Budget 
Office  of  Information  and  Regulatory  Affairs 

National  Security  Division  Special  Projects  Branch 
Federal  Chief  Information  Officers  Council 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division 
Inspector  General,  General  Services  Administration 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International  Relations, 
Committee  on  Government  Reform 
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Defense  Information  Systems 
Agency  Comments 


DEFENSE  INFORMATION  SYSTEMS  AGENCY 


701  S.  COURTHOUSE  ROAD 
ARLINGTON,  VIRGINIA  22204-2199 


Inspector  General 


12  January  1999 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL 
ATTN:  Kathryn  Palmer,  Readiness  and 
Logistics  Support  Directorate 

SUBJECT:  Agency  Response  to  the  Audit  Report  on  Year 

2000  Computing  Issues:  Defense  Logistics 
Agency  Distribution  Standard  System  (Project 
No.  8LD-9021) 

Reference:  DODIG  Draft  Audit  Report,  subject  as  above, 

8  December  1998 


1.  The  Defense  Information  Systems  Agency  has  reviewed  the 
subject  draft  report  and  agrees  with  the  findings  and 
recommendations.  Detailed  comments  are  enclosed. 

2.  The  Year  2000  ( Y2K)  problem  continues  to  be  the 
Director's  top  priority.  The  Director  has  maintained  a 
high  focus  on  the  Defense  Megacenters,  and  their  approach 
to  achieving  Y2K  compliance.  During  the  weekly  Y2K 
meetings,  chaired  by  the  Vice  Director,  the  DMCs  are 
highlighted  to  focus  on  the  complexities  involved  in 
certifying  all  domains. 

3.  The  WESTHEM  POC  for  this  action  is  Ms.  Teresa  White. 

She  can  be  contacted  at  (703)  681-2260.  The  DISA  OIG 
contact  is  Ms.  Barbara  Nichols.  She  can  be  reached  on 
(703)  607-6607. 

FOR  THE  DIRECTOR: 


1  Enclosure  a/s 


Inspector  General 


Quality  Information  for  a  Strong  Defense 


Recommendation  2a:  “Ensure  that  the  test  domain  is  Year  2000  compliant  prior 
to  the  certification  of  the  Distribution  Standard  System  as  Year  2000  compliant.” 

DISA  Response:  The  DISA  WESTHEM  Area  Command  responsible  for 
providing  a  test  domain  for  DLA's  DSS  is  Ogden.  This  test  domain  has  been 
established  and  is  referred  to  as  the  “MUL”  domain.  The  executive  software 
resident  in  that  domain,  along  with  its  current  Y2K  status  is  attached.  DLA  has 
requested  a  waiver  for  its  COBOL  II  compiler.  Aside  from  that  waiver  being 
granted,  DISA  projects  that  the  executive  software  resident  in  the  MUL  domain 
will  be  Y2K  compliant  by  31  Jan  99. 

Recommendation  2b:  “Validate  that  the  Year  2000  status  reported  for  the 
Defense  Megacenter  domains  is  accurate  and  that  the  status  of  software 
attributed  to  each  domain  is  accurate.” 

DISA  Response:  DISA  WESTHEM  has  established  a  comprehensive 
configuration  management  relational  database  called  the  Integrated  Asset  and 
Configuration  Management  System  (IA  &  CMS).  This  relational  database  is  an 
upgraded  program  from  the  earlier  Aperture  configuration  management  database 
and  data  that  populated  Aperture  was  carried  over  in  to  IA  &  CMS. 

In  order  to  ensure  the  integrity  of  the  data  populated  in  this  database,  DISA 
WESTHEM  had  teams  examine  and  perform  quality  control  checks  on  each  copy 
of  the  database  at  each  site.  These  site  databases  then  feed  up  into  the  master 
copy  of  IA  &  CMS  every  24  hours.  Additionally  DISA  WESTHEM  has  an 
established  Configuration  Management  program  managed  by  the  Configuration 
Management  branch  that  administers  stringent  policies  and  procedures  for 
access,  use  and  papulation  of  the  IA  &  CMS  database. 

Additionally,  beginning  with  its  December  report,  DISA  has  prepared  and 
submitted  a  monthly  Y2K  compliant  domain  status  report  to  OSD.  This  report 
reflects  the  close  scrutiny  that  DISA  gives  to  every  domain  every  month  This 
report  covers  every  domain  that  will  NOT  be  compliant  by  31  March  1999  - 
including  the  hardware,  executive  software  and  application  status.  This  report 
also  delineates  the  cause  for  domain  compliance  delay  and  the  planned 
remediation.  This  report  is  staffed  through  DISA  Headquarters  before 
transmitted  to  OSD  C3I. 

Recommendation  2c:  “Obtain  a  waiver  for  the  compiler  associated  with  the 
Distribution  Standard  System  test  and  production  domains.” 


OISA  Response:  DLA  Is  the  responsible  party  for  the  COBOL  II  compiler  used 
by  DSS,  and  as  such  is  the  submitting  organization  for  the  waiver  request  to 
OSD.  DISA  WESTHEM  and  DLA  are  in  close  contact  on  the  status  of  this  waiver 
and  DISA  WESTHEM  is  willing  to  assist  DLA  in  any  manner  that  it  can  to  assure 
this  waiver  is  granted. 

Recommendation  2d:  “Initiate  and  sign  explicit  Distribution  Standard  System 
test  agreements  between  the  Defense  Information  Systems  Agency  megacenters 
and  the  Defense  Logistics  Agency  as  required  by  the  Secretary  of  Defense  policy 
of  August  7, 1998." 

DISA  Response:  DISA  has  signed  Memorandums  of  Agreement  with  its  major 
customers  that  cover  the  Y2K  testing  arrangements.  These  documents  are  available  for 
review  and  have  been  provided  to  the  DOD  16.  DISA  is  also  providing  a  cross- 
reference  to  associate  each  domain  back  to  the  major  customer. 
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Defense  Logistics  Agency  Comments 


DEFENSE  LOGISTICS  AGENCY 
HEADQUARTERS 

8725  JOHN  J.  KINGMAN  ROAD,  SUITE  2533 
FT.  BELVOIR,  VIRGINIA  22060-6221 

"dAN  *  i  1999 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL  FOR  AUDITING, 
DEPARTMENT  OF  DEFENSE 


SUBJECT:  DoD  IG  Draft  Report,  Year  2000  Computing  Issues  :  DLA  Distribution  Standard 
System,  8  Dec  98  (Project  No.8LD-9021) 


Enclosed  are  comments  in  response  to  your  request  of  8  January  1998.  The  action  officer  for 
DDAI  is  Peggy  Hayes  767-6262. 


Enclosures  SHEILA  P.  RAINES 

Team  Leader,  Liaison  &  Policy 
Internal  Review  Office 

cc:  ' 

CIO 


F«d*ral  Recycling  Program 


© 


PrinUd  on  fUcyctad  Pap«r 


JAN  2  1  1999 


Draft  Audit  Report  “Year  2000  Computing  Issues;  Defense  Logistics  Agency 

Distribution  Standard  Systems”  (Project  No.  8LD-9021) 

la.  Develop  and  implement  a  depot-level  year  2000  checklist. 

Response:  Partially  concur,  The  Defense  Logistics  Support  Command  (DLSC) 
and  Defense  Distribution  Center  (DDC)  have  provided  adequate  guidance  for  the  depots. 
DDC  has  established  a  comprehensive  program  and  procedures  to  ensure  depots  are  year 
2000  (Y2K)  compliant.  In  January  1998,  the  DDC  issued  its  supplemental  guidance  to 
the  DLA  Y2K  Management  Plan,  which  included  a  Y2K  checklist  to  assist  efforts  at  the 
depot  level,  Facility  reporting  and  in-process  reviews  are  also  held  on  all  items  being 
checked.  The  assessment  and  reporting  process  serves  to  verify  information  provided  on 
the  checklist.  This  recommendation  was  based  on  a  finding  in  the  report  that  identified  a 
software  program  (NS/ELIT  PLUS,  version  2.20)  which  was  not  listed  as  Y2K 
compliant.  This  vendor  erroneously  identified  version  2.20  as  being  noncompliant.  The 
vendor  has  since  stated  that  its  version  2.20  is  Y2K  compliant.  Notwithstanding,  the 
depot  has  downloaded  the  version  2.22  from  the  vendor  web  site  and  has  upgraded  its 
personal  computers  at  no  cost  to  the  government. 

lb.  Complete  the  inventory  of  all  Distribution  Standard  System  (DSS)  interfaces  and 
prepare  interface  agreements  that  contain  the  required  data  elements  for  all  mission- 
critical  interfaces. 

Response:  Partially  concur.  The  original  inventory  was  completed  in  September 
1998,  but  in  preparing  for  follow-on  interface  testing,  three  additional  interfaces  requiring 
Memoranda  of  Agreement  (MO  A)  were  identified.  All  interfaces  were  identified  in  the 
document  entitled:  "Distribution  Standard  System  (DSS)  Year  2000  Follow  on  Interface 
Test  Plan"  dated  November  13, 1998.  MOA  for  all  seven  external  interfaces  have  been 
signed. 

lc.  Include  the  complete  inventory  of  interfaces  in  the  follow-on  interface  testing  prior  to 
year  2000  certification. 

Response:  Nonconcur.  DSS  is  a  compliant  production  system.  DLA  issued 
guidance  on  June  16, 1998  based  on  Director,  Operational  Test  and  Evaluation  (OT&E) 
memorandum  of  April  25, 1997  which  required  DLA  to  verify  Year  2000  compliance  on 
systems  that  have  already  completed  OT&E.  DLA’s  guidance  to  the  program  managers 
and  functional  sponsors  was  to  validate  Y2K  compliance  on  systems  currently  in 
production  and  provide  status  reports  and  a  final  Y2K  certification  to  the  Chief 
Information  Officer,  DSS  validation  testing  included  more  than  200  scenarios  and  2,200 
test  cases.  Only  three  incidents  in  14,500,000  tines  of  code  test  required  a  Y2K.  change. 
As  part  of  the  validation  testing,  examples  were  captured  of  all  interface  transactions  and 
they  were  simulated  to  the  DSS.  Additional  interface  testing  will  be  accomplished  during 
the  logistics  end  to  end  tests.  There  was  no  missing  interface  inventory  identified  in  the 
document  entitled:  "Distribution  Standard  System  (DSS)Year  2000  Follow  on  Interface 
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Test  Plan"  dated  November  13, 1998.  The  MOA  for  the  last  interface  was  signed  on 
December  22, 1998  and  the  system  was  certified  on  December  30, 1998. 

Id.  Develop  a  comprehensive  test  plan  and  schedule  for  the  operational  assessment  and 
time  machine  testing. 

Response:  Concur.  In  accordance  with  existing  test  regulations,  the  DLA  test 
and  certification  process  requires  test  plans  for  systems.  As  a  result  of  validation  testing, 
the  Defense  Distribution  Systems  Center  (DDSC)  provided  status  reports,  a  final  Y2K 
certification  package  with  a  test  plan  and  test  report.  To  satisfy  operational  assessments 
and  time  machine  testing,  DLA  has  requested  a  proposal  fiom  DIS  A  for  the  conduct  of 
time  machine  testing  and  Logistics  Capstone  end-to-end  testing  for  DSS  during  the 
period  March  -  June  1 999.  The  DSS  participation  in  time  machine  testing  and  logistics 
capstone  testing  is  delineated  in  the  DLA  appendix  to  the  OSD  test  plan. 

2a.  Ensure  that  the  test  domain  is  year  2000  compliant  prior  to  the  certification  of  the 
Distribution  Standard  System  as  year  2000  compliant. 

Response:  Nonconcur.  DLA  has  secured  a  waiver  fiom  OSD  that  allows  DSS 
be  certified  as  Y2K  compliant  based  on  the  test  conducted.  The  noncompliant  products 
the  test  domain  were  products  not  used  by  DSS  and  had  no  impact  on  the  system. 

2b.  Validate  that  the  year  2000  status  reported  for  the  Defense  Megacenter  domains  is 
accurate  and  that  the  status  of  the  software  attributed  to  each  domain  is  accurate. 

Response:  Concur.  DLA  has  access  to  the  D1SA  software  database  and  has 
validated  the  accuracy  of  the  software  in  each  Defense  Megacenter  domain  that  runs 
DSS.  This  domain  status  is  also  reported  to  OSD.  It  is  our  understanding  that  the  non¬ 
compliant  products  at  DISA  Area  Command  Ogden  have  been  upgraded  or  removed  by 
DISA  as  of  December  20, 1998.  The  Mechanicsburg  location  will  have  its  noncompliant 
products  replaced  or  upgraded  in  January  1999. 

2c:  Obtain  a  waiver  for  the  compiler  associated  with  the  Distribution 
Standard  System  test  and  production  domains. 

Response:  Concur.  DLA  has  secured  a  waiver  from  OSD  that  allows  the  use  of 
the  COBOL  compiler  for  DSS. 

2d.  Initiate  and  sign  explicit  DSS  test  agreement  between  the  DISA  Megacenters  and 
DLA  as  required  by  Secretary  of  Defense  policy  of  August  7,  1998. 

Respouse:  Partially  concur.  DLA  signed  explicit  test  agreements  with  DISA  in 
September  1998  with  DMC  Columbus  as  the  sponsor  for  DLA  for  all  DISA  Megacenters. 
The  specific  systems  are  identified  in  attachment  2  of  the  DISA  memorandum  of 
agreement. 
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